Declare experimental Amazon Bedrock setup APIs (#39277)

## What changed

- Add experimental `account/bedrock/discover` and `account/bedrock/setup`
  requests to the app-server protocol.
- Define discovery results for AWS profiles and environment credentials, plus
  setup inputs for profiles, environment credentials, and access keys.
- Export the new types in the experimental protocol schema. The app server
  currently returns `method not found` for both requests because setup is not
  yet implemented.

GitOrigin-RevId: 656b4bc11231a417e97041068cecc5dc692786e3

codex-rs/app-server-protocol/src/export.rs

@@ -44,6 +44,9 @@ pub(crate) const GENERATED_TS_HEADER: &str = "// GENERATED CODE! DO NOT MODIFY B
 const IGNORED_DEFINITIONS: &[&str] = &["Option<()>"];
 const JSON_V1_ALLOWLIST: &[&str] = &["InitializeParams", "InitializeResponse"];
 const EXPERIMENTAL_CLIENT_METHOD_DEPENDENCY_TYPES: &[&str] = &[
+    "AwsCredentialType",
+    "BedrockAwsProfile",
+    "BedrockEnvironmentCredential",
     "EnvironmentShellInfo",
     "EnvironmentStatusKind",
     "RemoteControlClient",

codex-rs/app-server-protocol/src/protocol/common.rs

@@ -1168,6 +1168,20 @@ client_request_definitions! {
         response: v2::LoginAccountResponse,
     },
 
+    #[experimental("account/bedrock/discover")]
+    BedrockDiscover => "account/bedrock/discover" {
+        params: v2::BedrockDiscoverParams,
+        serialization: global_shared_read("account-auth"),
+        response: v2::BedrockDiscoverResponse,
+    },
+
+    #[experimental("account/bedrock/setup")]
+    BedrockSetup => "account/bedrock/setup" {
+        params: v2::BedrockSetupParams,
+        serialization: global("account-auth"),
+        response: v2::BedrockSetupResponse,
+    },
+
     CancelLoginAccount => "account/login/cancel" {
         params: v2::CancelLoginAccountParams,
         serialization: global("account-auth"),

codex-rs/app-server-protocol/src/protocol/v2/bedrock.rs

@@ -0,0 +1,74 @@
+use crate::JsonSchema;
+use crate::TS;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Serialize, Deserialize, Debug, Default, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct BedrockDiscoverParams {}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct BedrockDiscoverResponse {
+    pub profiles: Vec<BedrockAwsProfile>,
+    pub environment_credentials: Vec<BedrockEnvironmentCredential>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct BedrockAwsProfile {
+    pub name: String,
+    pub region: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct BedrockEnvironmentCredential {
+    #[serde(rename = "type")]
+    #[ts(rename = "type")]
+    pub credential_type: AwsCredentialType,
+    pub region: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub enum AwsCredentialType {
+    AccessKeys,
+    BedrockApiKey,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(tag = "type", rename_all = "camelCase")]
+#[ts(tag = "type", rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub enum BedrockSetupParams {
+    #[serde(rename_all = "camelCase")]
+    #[ts(rename_all = "camelCase")]
+    Profile { profile: String, region: String },
+    #[serde(rename_all = "camelCase")]
+    #[ts(rename_all = "camelCase")]
+    Environment {
+        credential_type: AwsCredentialType,
+        region: String,
+    },
+    #[serde(rename_all = "camelCase")]
+    #[ts(rename_all = "camelCase")]
+    AccessKeys {
+        access_key_id: String,
+        secret_access_key: String,
+        #[ts(optional = nullable)]
+        session_token: Option<String>,
+        region: String,
+    },
+}
+
+#[derive(Serialize, Deserialize, Debug, Default, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct BedrockSetupResponse {}

codex-rs/app-server-protocol/src/protocol/v2/mod.rs

@@ -3,6 +3,7 @@ mod shared;
 mod account;
 mod apps;
 mod attestation;
+mod bedrock;
 mod collaboration_mode;
 mod command_exec;
 mod config;
@@ -34,6 +35,7 @@ mod windows_sandbox;
 pub use account::*;
 pub use apps::*;
 pub use attestation::*;
+pub use bedrock::*;
 pub use collaboration_mode::*;
 pub use command_exec::*;
 pub use config::*;

codex-rs/app-server/src/message_processor.rs

@@ -1501,6 +1501,9 @@ impl MessageProcessor {
                     .login_account(request_id.clone(), params)
                     .await
             }
+            ClientRequest::BedrockDiscover { .. } | ClientRequest::BedrockSetup { .. } => Err(
+                crate::error_code::method_not_found("Amazon Bedrock setup is not implemented"),
+            ),
             ClientRequest::LogoutAccount { .. } => {
                 self.account_processor
                     .logout_account(request_id.clone())